Blue team notes, built in the open
Practical walkthroughs on alert triage, detection engineering, incident response and threat hunting. Written step by step, with queries you can copy and labs you can repeat.
Latest
A hands-on triage guide for device code sign-ins in Entra ID: separate real use from phishing, check for token abuse and device registration, then contain the account.
AI agents don’t just answer questions: they plan steps, use tools and take actions. Here’s how they help on shift, where they fail, and how to detect and govern them as non-human identities.
A repeatable beginner workflow for the most common SOC alert: lots of failed Windows logons. Read the alert, enrich, scope, decide and document.
Topics
Learning path
Tiers, shifts, the alert lifecycle and the tools you will touch on day one.
Open track →A repeatable workflow for reading alerts, enriching indicators and reaching a verdict.
Open track →Write, test and tune rules so the SOC sees the right things with less noise.
Open track →Contain, investigate and report, using a structure that holds up under pressure.
Open track →Short threads on detections, event IDs, triage tricks and new posts as they go live.
